There's a lot of plugins running on the site if you look at the link I made early in the thread. From a quick scan, I'd not have any immediate concerns with most of them though.
The last one would be the hardest to find and deal with and would need someone highly technical, But it's also unlikely to be an issue unless it's a home-written site and someone has gone after your site for a particular reason.
Directory and file permissions, if incorrect, would easily allow a...
Oh it's your OFS site?
I've just been there and seen that red cross - it's also showing me seemingly logged in as m***.shel***@impro***.com (I put the stars in) in the top right of the site. So, do the bad guys have login credentials?
Obvious places to look, although I'd have expected the...